Information
When a mobile device is no longer going to be managed by MDM technologies, its protected/sensitive data must be sanitized because it will no longer be protected by the MDM software, so it is at much greater risk of unauthorized access and disclosure. At least one of the two options must be selected.
SFR ID: FMT_SMF_EXT.2.1
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
On the MDM console:
Enable 'Disallow remove managed profile'.
Prior to unenrollment, the MDM administrator should issue a factory reset to ensure all data is wiped by doing the following in the MDM console:
Wipe data.